Microsoft SharePoint Code Injection Vulnerability
TL;DR 📌
- Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.
- Highest CVSS: 8.8 (High).
- Listed in CISA KEV (2026-09-25) — this is being exploited in the wild.
- Fixed in
16.0.19725.20522— upgrade to this release or later. - CVEs: CVE-2026-65660.
What it is
CVE-2026-65660 is a code injection flaw in Microsoft SharePoint, arising from improper control of code generation within the product. An authenticated attacker with low privileges (PR:L) can send a crafted request over the network to trigger execution of arbitrary code, with no user interaction required.
The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates this is reachable remotely against the SharePoint server itself, not a client-side or local attack. Because the impact is full compromise of confidentiality, integrity and availability (C:H/I:H/A:H), a successful attacker can expect to run code with the privileges of the SharePoint application, potentially extending to the underlying server depending on configuration.
This is listed in the CISA Known Exploited Vulnerabilities catalogue, added on 2026-09-25. This confirms exploitation has been observed; no detail on ransomware association is available.
What to do
- Patch to the fixed build 16.0.19725.20522 or later. Consult Microsoft’s SharePoint update channel for the exact package matching your deployment (Subscription Edition, Server 2019, etc.), as the specific SKU mapping is not detailed here.
- Given the KEV listing, treat this as an active exploitation risk and prioritise patching over standard maintenance windows.
- Review SharePoint authentication and account provisioning — since exploitation requires only low-privilege authenticated access (PR:L), audit who holds valid SharePoint accounts and tighten access where accounts are broader than necessary.
- Check SharePoint server and IIS logs for anomalous authenticated requests preceding the patch date, particularly any unusual POSTs to SharePoint application or API endpoints.
- Ensure SharePoint servers are not unnecessarily exposed to untrusted networks; where external access is required, confirm it sits behind additional authentication controls (e.g. MFA, conditional access) pending patch deployment.
For leadership 🧭
Executive summary. An authenticated attacker needing only low-level SharePoint access can remotely execute code on the server, and this is already being exploited according to CISA’s known exploited vulnerabilities list. Given active exploitation, patching should be treated as urgent rather than scheduled into routine maintenance.
Why it matters:
- Exploitation requires only a low-privilege authenticated SharePoint account, not admin rights, so any user with valid credentials is a potential entry point.
- Successful exploitation gives full compromise of confidentiality, integrity and availability, meaning an attacker can read, alter or disrupt SharePoint data and potentially reach the underlying server.
- The flaw is confirmed to be exploited in the wild via its CISA KEV listing added 25 September 2026, so this is not a theoretical risk.
- No user interaction is needed and the attack works directly over the network against the SharePoint server itself, removing typical client-side defences as a mitigating factor.
Now / Next / Later:
- Now: Identify all SharePoint servers running versions earlier than 16.0.19725.20522 and confirm which ones are reachable by authenticated users, including any exposed to external or less-trusted networks.
- Next: Apply the fixed build 16.0.19725.20522 (or later) to affected SharePoint servers ahead of normal patch cycles, using Microsoft’s update channel matching your specific SKU.
- Later: Review and tighten SharePoint account provisioning so that low-privilege accounts are limited to what they need, and add MFA or conditional access in front of SharePoint for any internet-facing deployments.